diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c

--- a/lib/ssl/sslsock.c

+++ b/lib/ssl/sslsock.c

@@ -2382,16 +2382,26 @@ ssl3_CreateOverlapWithPolicy(SSLProtocol

     rv = ssl3_GetEffectiveVersionPolicy(protocolVariant,

                                         &effectivePolicyBoundary);

     if (rv == SECFailure) {

         /* SECFailure means internal failure or invalid configuration. */

         overlap->min = overlap->max = SSL_LIBRARY_VERSION_NONE;

         return SECFailure;

     }

+    /* TODO: TLSv1.3 doesn't work yet under FIPS mode */

+    if (PK11_IsFIPS()) {

+        if (effectivePolicyBoundary.min >= SSL_LIBRARY_VERSION_TLS_1_3) {

+            effectivePolicyBoundary.min = SSL_LIBRARY_VERSION_TLS_1_2;

+        }

+        if (effectivePolicyBoundary.max >= SSL_LIBRARY_VERSION_TLS_1_3) {

+            effectivePolicyBoundary.max = SSL_LIBRARY_VERSION_TLS_1_2;

+        }

+    }

+

     vrange.min = PR_MAX(input->min, effectivePolicyBoundary.min);

     vrange.max = PR_MIN(input->max, effectivePolicyBoundary.max);

     if (vrange.max < vrange.min) {

         /* there was no overlap, turn off range altogether */

         overlap->min = overlap->max = SSL_LIBRARY_VERSION_NONE;

         return SECFailure;

     }